ci: add dedicated verify stage for GPG signature checks

[marcstraube]

Problem

The verify-signatures job runs in the test stage alongside all other jobs. If signatures are invalid, expensive test/analysis jobs still start before the verification fails.

Solution

Add a dedicated verify stage that runs before test (as implemented in zappzarapp/audit-logger):

stages:
  - verify
  - test
  - security

Move verify-signatures to stage: verify so it fails fast.

Reference

• zappzarapp/audit-logger .gitlab-ci.yml